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(57) Abstract L 

A sensor provides a measurement and information about the validity of the measurement. The sensor includes a transducer 
for generating a data signal related to the value of a variable and a transmitter for receiving the data signal and generating output 
signals. The transmitter generates a first output signal related to the value of the variable. The transmitter also generates a second 
output signal based on a dynamic uncertainty analysis of the first output signal. 
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SELF— VALIDATING SENSORS 
Background of the Invention 
This invention relates to sensors and to control 
5 systems incorporating sensors, 

A sensor generates measurement data. Typically, 
the measurement data is a signal that estimates the value 
of a process variable. In practice, the signal does not 
perfectly represent the value of the process variable. 
10 Instead, the signal also includes effects resulting from 
the sensor (such as sensor faults or distortion) and 
other process influences (including those attributable to 
"faulty" process behavior) . 

Sensor and control system designers employ 
15 numerous techniques to increase the reliability of 

measurement data. For example, sensor designers try to 
develop improved sensor designs that minimize both the 
occurrence of sensor faults and the distortions occurring 
during normal operation. In another approach, control 

2 0 system designers implement rigorous programs of sensor 

checking, maintenance, and calibration to reduce both the 
frequency at which sensor faults occur and the distortion 
caused by poorly maintained sensors. 

In conjunction with increasing the reliability of 
25 measurement data, designers employ fault detection 
techniques to increase a control system's ability to 
recognize that measurement data is unreliable. For 
example, control system designers often rely on sensor 
redundancy to reduce the effect of any sensor fault that 

3 0 may occur. If measurement data from a sensor in a group 

of redundant sensors is inconsistent with measurement 
data from other sensors in the group, a control system 
can designate the inconsistent data as unreliable and 
ignore that data. 
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In another approach to fault detection, control 
systems monitor information about the process and the 
sensor for signs of sensor faults. Until recently, 
sensors have been limited to a single analog 
5 communication channel, normally based on the 4-2 OmA 

convention, and, therefore, have been unable to transmit 
signals other than a measurement data signal. Faced with 
this limitation, users of process fault detection 
techniques have tried to extract sensor and process fault 

10 information from measurement data. However, in 

attempting to minimize distortion of the measurement 
data, sensor designers have tried to eliminate, by 
sophisticated filtering and other means, every component 
of the measurement data signal that does not actually 

15 relate to the variable being measured. Thus, improved 

sensor designs have limited the information available for 
extraction from the measurement signal for fault 
detection purposes. 

Recent use of digital communications technology by 

20 control system designers has enabled sensors to transmit 
multiple signals. This, in combination with internal 
diagnostics generated by microprocessors, which are now 
commonly embedded within sensors, has resulted in sensors 
that are able to perform fault detection analyses 

25 internally and transmit the results of these analyses as 
a fault information signal. Typically, the fault 
information signal is either a device specific error code 
or a single bit which indicates that the sensor is either 
functional or nonfunctional. 

3 0 Summary of the Invention 

The invention provides a self-validating sensor 
for use in process control systems. A self -validating 
sensor provides, based on all information available to 
the sensor, a best estimate of the value of a parameter 

35 being monitored. Because the best estimate is based, in 
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part, on nonmeasurement data, the best estimate does not 
always conform to the value indicated by the current, 
possibly faulty, measurement data. A self -validating 
sensor also provides information about the uncertainty 
5 and reliability of the best estimate, as well as 

information about the operational status of the sensor. 
Uncertainty information is derived from known uncertainty 
analyses and is provided even in the absence of faults. 

In one aspect, generally, the invention features a 

10 sensor that includes a transducer that generates a data 
signal related to the value of a variable and a 
transmitter that receives the data signal and generates 
output signals in response. The transmitter generates a 
first output signal related to the value of the variable 

15 and a second output signal based on a dynamic uncertainty 
analysis of the first output signal. When the sensor 
experiences a fault, the transmitter modifies the first 
and second output signals to account for the impact of 
the fault. In some embodiments, the transmitter 

20 generates a third output signal that indicates a state of 
reliability of the first output signal. 

The second output signal, which provides on line 
uncertainty, can be used for data quality management. A 
specified maximum permitted uncertainty can be used, for 

25 example, in specifying plant instrumentation, supervising 
feedback control, scheduling maintenance, and 
demonstrating adequate data quality for environmental 
compliance or custody transfer applications. 

Generally, the invention provides a standard, 

30 device- independent method of communicating sensor faults 
and measurement quality, which eases integration into 
control schemes. In some cases, this avoids the cost of 
sensor redundancy and constant calibration programs, 
which, in any large or complicated process plant, are 

35 quite costly and of dubious value. 
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The invention also eases implementation of fault 
detection schemes by supplying a common set of variables 
in a generic form for use by control systems and 
requiring sensor designers , who are in the best position 
5 to recognize and define faulty behavior, to implement the 
actual fault detection in the sensors themselves. 

Brief Description of the Drawing 
Fig. X is a block diagram of a process control 
system with multiple sensors and actuators. 
10 Fig. 2 is a block diagram of a sensor according to 

the invention. 

Fig. 3 is a block diagram showing the flow of 
information in the sensor of Fig. 2. 

Fig. 4 is a composite graph showing three methods 
15 of responding to a fault in the sensor of Fig. 2. 

Fig. 5 is a composite graph of various signals 
produced by the sensor of Fig. 2 versus time. 

Fig. 6 is a block diagram showing the timing of 
information flow in the sensor of Fig* 2. 
20 Fig. 7 is a block and schematic diagram of a 

temperature sensor according to the invention. 

Fig. 8 is a set of composite graphs of an 
auxiliary signal (upper graph), raw temperature (middle 
graph) , and validated temperature and uncertainty (lower 
25 graph) versus time for the instrument of Fig. 7. 

Fig. 9 is a set of composite graphs of raw data 
(upper graph) , raw temperature (middle graph) and 
validated temperature and uncertainty (lower graph) 
versus time for the instrument of Fig. 7. 
3 0 Fig* 10 is a paired composite graph of auxiliary 

data (upper graph) and validated temperature and 
uncertainty (lower graph) for the instrument of Fig. 7. 

Fig. 11 is a schematic and block diagram of a 
Coriolis flow meter. 
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Fig. 12 is pseudocode showing steps performed by 
the meter of Fig. 11 during each sampling period. 

Fig. 13 is pseudocode showing steps performed by 
the meter of Fig. 11 in determining temperature and 
5 associated uncertainty. 

Fig. 14 is pseudocode showing steps performed by 
the meter of Fig. 11 in diagnosing a fault. 

Fig. 15 is a set of composite graphs showing the 
effect of a loss of temperature on temperature (upper 
10 graphs) , density (middle graphs) and mass flow rate 
(lower graphs) versus time for the meter of Fig. 11. 
Description of the Preferred Embodiments 
Referring to Fig. 1, in a process control system 
10, a plurality of sensors 12 monitor parameters of a 
15 process 14 and provide signals about the monitored 

parameters to a data control and management system 16 on 
a digital communications link 18. Digital communications 
link 18 allows bidirectional communication between 
multiple central processing units 16 , sensors 12 , and 
20 process actuators 20. In response to signals from 

sensors 12, data control and management system 16 sends 
process control signals to process actuators 2 0 on 
digital communications link 18. Thereafter, process 
actuators 20 respond to process control signals from data 
25 control and management system 16 by modifying parameters 
of process 14. 

Because data control and management system 16 
relies on measurement signals from sensors 12 in 
controlling process 14, measurement signals from sensors 
30 12 need to be accurate and reliable. A given sensor 12 
typically cannot guarantee complete accuracy and 
reliability; instead, sensor 12 provides data control and 
management system 16 with indications of the uncertainty 
(which, in turn, indicates the accuracy) and the 
35 reliability of the measurement signals. 
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Referring also to Fig. 2, sensor 12 includes one 
or more transducers 22 that monitor the values of 
parameters of process 14 and provide signals to a 
transmitter 24. Transmitter 24 samples the signals from 
5 transducers 22 and produces measurement values for the 
parameters being monitored by transducers 22. 
Transmitter 24 validates the measurement values and 
provides the validated measurement values r along with an 
indication of the uncertainty of the validated 

10 measurement values, to data control and management system 
16 via digital communications link 18. In addition, 
transmitter 24 generates signals indicating the 
reliability of the validated measurement values provided 
by sensor 12 and the operational status of sensor 12 , and 

15 provides these signals to data control and management 
system 16 via digital communications link 18. 

Transmitter 24 generates the signals provided to 
data control and management system 16 during a sample 
period and transmits the signals at the end of the sample 

20 period. Typically, the duration of a sample period is 
less than one second, but this duration can be adjusted 
as required by a particular application. 

As shown in Fig. 3, transmitter 24 typically 
provides four signals to data control and management 

25 system 16: 

(1) VMV 26 - a validated measurement value of a 
process parameter (transmitter 247s best 
estimate of the value of the measured 
parameter) , 

30 (2) VU 28 - a validated uncertainty associated 

with VMV 26, 

(3) MV status 30 - the status of VMV 2 6 (the 
manner in which VMV 26 was calculated) , and 

(4) device status 32 - the operational status of 
35 the sensor. 
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If sensor 12 measures multiple process parameters, 
transmitter 24 produces a version of VMV 26 , VU 28, and 
MV status 3 0 for each process parameter. 

In some circumstances, transmitter 24 can provide 
5 additional information. For example, upon a request by 
data control and management system 16, transmitter 24 
provides detailed diagnostic information 34 about the 
status of sensor 12. Also, when a measurement has 
exceeded, or is about to exceed, a predetermined limit, 
10 transmitter 24 can send alarm data 35. Typically, 
different alarm levels can be used to indicate the 
severity with which the measurement has deviated from the 
predetermined value. 

VMV 26 and VU 28 are numeric values. For example, 
15 VMV 26 could be a temperature measurement valued at 200 
degrees and VU 28, the uncertainty of VMV 26, could be 9 
degrees. In this case, there is a high probability 
(typically 95%) that the actual temperature being 
measured falls within an envelope around VMV 2 6 and 

2 0 designated by VU 28 (191 degrees to 2 09 degrees) . 

Transmitter 24 generates VMV 26 based on a signal 
produced by transducer 22. First, transmitter 24 derives 
RMV 36, an unvalidated image of the measured process 
parameter that is based on the signal generated by 
25 transducer 22. Typically, when transmitter 24 detects no 
abnormalities in sensor 12, transmitter 24 has nominal 
confidence in RMV 36 and sets VMV 26 equal to RMV 36. 

As discussed in more detail below, when 
transmitter 24 detects an abnormality in sensor 12, 

3 0 transmitter 24 does not set VMV 2 6 equal to RMV 36. 

Instead, transmitter 24 sets VMV 2 6 to a value that 
transmitter 24 considers to be a better estimate of the 
actual parameter than RMV 36. If transmitter 24 detects 
a fault in sensor 12 that only partially affects the 
35 reliability of RMV 36 such that transmitter 24 has 
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reduced confidence in RMV 3 6 , transmitter 24 typically 
rederives RMV 36 by modifying the parameters used in 
deriving RMV 36 to account for the fault, and sets VMV 26 
equal to the new value of RMV 36. Alternatively, if 
5 transmitter 24 detects a fault in sensor 12 which 

indicates that RMV 36 bears no relation to the actual 
measured value such that transmitter 24 has zero 
confidence in RMV 36, transmitter 24 sets VMV 26 to a 
value based on past performance. 

10 Referring also to Fig. 4, three examples of past 

performance values include short term past values, long 
term past values, and a combination of long and short 
term past values. As shown in (a) , when short term past 
values are used, VMV 26 can equal the value of VMV 26 had 

15 immediately prior to the fault that occurs at time 5. As 
shown in (b) , when long term past value are used, VMV 26 
can equal the average value of VMV 26. As shown in (c) , 
when a combination of long arid short term past values is 
used, the long and short term past values can be combined 

20 using the following equation, which weighs each value 
according to its uncertainty: 

vu L 2 vu s 2 

VM^L&S = " — Z * VMV S + — * VMV L 

vu L 2 + vu s 2 vu L 2 + vu s 2 

25 where VU L and VU S are the long and short term past values 
for VU 28 and VMV L and VMV S are the long and short term 
past values for VMV 26. 

Transmitter 24 generates VU 28 based on a raw 
uncertainty signal, RU 62, that is the result of a 

30 dynamic uncertainty analysis of RMV 36. Transmitter 24 
performs this uncertainty analysis during each sampling 
period. Uncertainty analysis, originally described in 

"Describing Uncertainties in Single Sample Experiments, 11 
S.J. Kline & F.A. McClintock, Mech. Eng. . 75, 3-8 (1953), 

35 has been widely applied and has achieved the status of an 
international standard for calibration. Essentially, an 
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uncertainty analysis provides an indication of the 
"quality" of a measurement. Every measurement has an 
associated error, which, of course, is unknown. However, 
a reasonable limit on that error can often be expressed 
5 by a single uncertainty number (ANSI/ASME PTC 19.1-1985 
Part 1, Measurement Uncertainty: Instruments and 
Apparatus) . 

As described by Kline & McClintock, for any 
observed measurement M , the uncertainty in M, w M , can be 

10 defined as follows: 

M truB e [M - W M , M + W M ] 
where M is true (AT true ) with a certain level of confidence 
(typically 95%) . This uncertainty is readily expressed 
in a relative form as a proportion of the measurement 

15 (i.e. w M /M) . 

A propagation rule exists for obtaining the 
uncertainties of arbitrary functions of primary 
measurements. For example, for an arbitrary function R 
of variables X, Y, and Z, 

20 R = R(X,Y,Z) 

the uncertainty of R is given by 

lw R /Rl 2 = [SR/aX} 2 [W X /R1 2 + [dR/dYl 2 [w Y /R] 2 
+ [dR/dZ^ 2 [w z /R] 2 
This sum of squares form is derived from the Taylor 

25 series, and assumes the independence of X, Y, and Z, that 
their relative uncertainties are "small", and that all 
uncertainties are expressed at the same probability 
level. For purposes of this application, all 
uncertainties are assumed to be at 95% probability. 

30 One of the uses of the uncertainty propagation 

formula is to reveal particular circumstances that can 
result in a higher or lower than expected level of 
uncertainty. For example, as discussed in S.J. Kline, 
"The Purposes of Uncertainty Analysis", ASME Journal of 
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Fluids Engineering , Vol. 107 , No. 2, pp. 153-160, 1985, 
if R is calculated from x and y using the equation 

R = x - y, 
the uncertainty in R, vr Rr is given by 
5 nr^/i? = [(x/(x-y) * w x /x) 2 + (y/(x-y) * ^ y /y) 2 ] 1/2 . 

If x = 1.0, y = 0.98, and the uncertainty in both x and y 
is 1%, then the uncertainty in R is: 

w r/ R = [ (1/0.02 * 0.01) 2 + (0.98/0.02 * 0.01) 2 ] 1 / 2 
= 0.700 = 70%. 

10 By comparison, if R is calculated from a variable z using 
the equation 

R = (1/(1 4- z)) 1 / 2 , 
the uncertainty in R is given by 

w R /R = w^/2(l + z). 

15 If z = 0.1 and the uncertainty is z is 20%, then the 
uncertainty in R is only 0.91%. 

On reflection these results should not be 
surprising. In the first example, two quantities of 
similar magnitude are being subtracted, which will 

20 increase the relative error in the result. In the 

second, although z has a large uncertainty, its influence 
on R is relatively small. Of course, for different 
values of x, y, and z f the impact of their uncertainties 
will vary. Uncertainty analysis is useful in that it can 

25 quantify these effects. 

Returning to Fig. 3, VU 28 has a non-zero value 
even under ideal conditions (i.e., a faultless sensor 
operating in a controlled, laboratory environment) . This 
is because the measurement produced by a sensor is never 

30 completely certain and there is always some potential for 
error. 

As with VMV 26, when transmitter 24 detects no 
abnormalities in sensor 12, transmitter 24 sets VU 28 
equal to RU 62. When transmitter 24 detects a fault in 
3 5 sensor 12 that only partially affects the. reliability of 
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RMV 36, transmitter 24 typically performs a new 
uncertainty analysis that accounts for effects of the 
fault and sets VU 28 equal to the results of this 
analysis. As with VMV 26, transmitter 24 sets VU 28 to a 
5 value based on past performance when transmitter 24 
determines that RMV 36 bears no relation to the actual 
measured value. 

Fig. 4 illustrates three exemplary techniques for 
adjusting VU 28 based on past performance values. First, 

10 as shown in (a) , VU 28 can be increased during each 

sampling period by the maximum observed rate of change of 
VMV 26. This technique, which tends to give good short 
term results, eventually produces unrealistic values for 
VU 28. Next, as shown in (b) , when VMV 26 is set equal 

15 to the long term average of VMV 26, VU 28 can indicate 
that VMV 26 can take any previous value of VMV 26. Thus, 
if VMV 26 always falls between 0 and 100 and VMV 26 is 
set to 50, VU 28 is set to 50. This technique tends to 
give unduly pessimistic short term results, but avoids 

2 0 the long term problems of method (a) . Finally, as shown 
in (c) , when VMV 26 is based on a combination of the long 
and short term past values for VMV 26, VU 28 can be 
calculated as follows: 

VUr * VUo 

25 vu L&s = - L - s 

(VU L 2 + VUg 2 ) 1 / 2 

where VU L and VU S are the long and short term past values 
for VU 28. 

To ensure that data control and management system 
30 16 uses VMV 26 and VU 28 properly, MV status 30 provides 

information about how VMV 26 and VU 28 were calculated. 

Transmitter 24 produces VMV 26 and VU 28 under all 

conditions — even when transducers 22 are inoperative. 

Often, data control and management system 16 needs to 
35 know whether VMV 26 and VU 28 are based on "live" or 

historical data. For example, if data control and 
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management: system 16 were using VMV 26 and VU 28 in 
feedback control and transducers 22 were inoperative, 
data control and management system 16 would need to know 
that VMV 26 and VU 28 were based on past performance. 
5 MV status 30 is based on the expected persistence 

of any abnormal condition and on the confidence of 
transmitter 24 in RMV 36. The four primary states for MV 
status are generated according to Table 1. 



Table 1 



Expected 
Persistence 


Confidence 
in RMV 


MV Status 


not applicable 


nominal 


CLEAR 


not applicable 


reduced 


BLURRED 


short 


zero 


DAZZLED 


long 


zero 


BLIND 



A CLEAR MV status 3 0 occurs when RMV 36 is within 
a normal range for given process conditions. A DAZZLED 
MV status 3 0 indicates that RMV 36 is quite abnormal, but 
the abnormality is expected to be of short duration. 

20 Typically r transmitter 24 sets MV status 30 to DAZZLED 
when there is a sudden change in the signal from 
transducer 22 and transmitter 24 is unable to clearly 
establish whether this change is due to an as yet 
undiagnosed sensor fault or to an abrupt change in the 

25 variable being measured. A BLURRED MV status 30 

indicates that RMV 36 is abnormal but reasonably related 
to the parameter being measured. For example, 
transmitter 24 may set MV status 30 to BLURRED when RMV 
36 is a noisy signal. A BLIND MV status 30 indicates 

30 that RMV 36 is completely unreliable and the fault is 
expected to persist. 

Two additional states for MV status 3 0 are 
INVALIDATED and SECURE. MV status 30 is UNVALIDATED when 
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transmitter 24 is not performing validation of VMV 26. 
MV status 30 is SECURE when VMV 2 6 is generated from 
redundant measurements in which transmitter 24 has 
nominal confidence. 
5 Device status 32 is a generic, discrete value 

summarizing the health of sensor 12 that is used 
primarily by fault detection and maintenance systems. 
Typically, device status 32 is in one of six states, each 
of which indicates a different operational status for 

10 sensor 12. These states are: GOOD, TESTING, SUSPECT, 
IMPAIRED, BAD, or CRITICAL. A GOOD device status 32 
means that sensor 12 is in nominal condition. A TESTING 
device status 32 means that sensor 12 is performing a 
self check, and that this self check 

15 may be responsible for any temporary reduction in 

measurement quality. A SUSPECT device status 32 means 
that sensor 12 has produced an abnormal response, but 
transmitter 24 has no detailed fault diagnosis. An 
IMPAIRED device status 32 means that sensor 12 is 

20 suffering from a diagnosed fault that has a minor impact 
on performance. A BAD device status 32 means that sensor 
12 has seriously malfunctioned and maintenance is 
required. Finally, a CRITICAL device status 32 means 
that sensor 12 has malfunctioned to the extent that 

25 sensor 12 may cause (or have caused) a hazard such as a 
leak, fire, or explosion. 

Fig. 5 illustrates an example of the relationship 
between VMV 26, VU 28, MV status 30, and RMV 36. In 
another aspect, Fig. 5 illustrates a preferred method of 

30 displaying the relationship between VMV 26 and VU 28 both 
during normal operation and when a fault has occurred: 
VU 28 is shown both as a separate signal and as an 
envelope surrounding VMV 2 6 (line 38 indicates the sum of 
VMV 2 6 and VU 28 and line 4 0 indicates the difference 

35 between VMV 2 6 and VU 28) . When VU 28 is expressed as an 
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envelope surrounding VMV 26, a user can, by examining the 
envelope, visually determine the range of probable values 
of the parameter represented by VMV 26 for any displayed 
time. 

5 In the region between time Tl and time T2, RMV 36 

is a periodic signal whose amplitude falls within an 
expected range. In this region, VMV 26 equals RMV 36, MV 
status 30 is CLEAR, and VU 28 remains at a constant 
"normal" level that corresponds to RU 62, the uncertainty 

10 under normal operating conditions (with line 42 

representing a zero value for VU 28). For purposes of 
this example, RU 62 is assumed to have a constant value. 

At time T2 , RMV 36 begins to increase at a rate 
that substantially exceeds an expected rate of change for 

15 RMV 36. Transmitter 24 takes a number of actions in 
response to this unexplained phenomenon. First, 
transmitter 24 changes MV status 30 to DAZZLED. Next, 
transmitter 24, which is basing VMV 26 and VU 28 on short 
term past performance values in this example, maintains 

20 VMV 26 at the value that VMV 26 had just before the 
sudden increase in RMV 36 at time T2 . Finally, 
transmitter 24 begins to increase VU 28 at a constant 
rate that equals the maximum rate of increase of VMV 26 
during normal operation. The progressive increase in the 

25 value of VU 28 over time reflects increasing uncertainty 
of the value of the measurement in the absence of up to 
date valid transducer data caused by sensor 12 being 
DAZZLED. 

RMV 36 continues to increase until time T3 . At 
30 time T3 , RMV 36 stops increasing and remains at a 

constant level. Because the value of RMV 36 now exceeds 
expected values, transmitter 24 does not .change VMV 26 or 
MV status 30, and continues to increase VU 28 at a 
constant rate. At time T4 , RMV 3 6 begins to decrease. 
35 Because the value of RMV 36 still exceeds expected 



WO 93/21505 



PCT/US93/03729 



- 15 - 

values, transmitter 24 makes no changes to VMV 26 or MV 
status 30, and continues to increase VU 28 at a constant 
rate . 

At time T5, RMV 36 begins to operate as expected. 
5 In response, transmitter 24 changes MV status 3 0 to 

BLURRED and begins to merge VMV 2 6 with RMV 36 using, for 
example, the following equation: 

^^n+i = 0.95 * VMV n + 0.05 * RMV n+1 
where VMV n+1 is the value of VMV 26 for the current 
10 sample, VMV n is the value of VMV 26 generated in the 

previous sample, and RMV n+1 is the value of RMV 36 for the 
current sample. Next, transmitter 24 initializes a 
recovery timeout period. Finally, transmitter 24 begins 
to decrease VU 28 by merging VU 28 with RU 62 using, for 
15 example, the following equation: 

VU n+1 2 - 0.95 2 * VU n 2 4- 0.05 2 * RU n+1 2 
where VU n+1 is the value of VU 28 for the current sample, 
VU n is the value of VU 28 generated in the previous 
sample, and RU n+1 is the value of RU 62 for the current 
20 sample. 

At time T6, transmitter 24 determines that the 
recovery timeout period has expired and changes MV status 
3 0 to CLEAR. Because transmitter 24 now has nominal 
confidence in RMV 36, transmitter 24 sets VU 28 equal to 
25 RU 62. 

If, at time T5, RMV 3 6 had not returned to 
expected levels, sensor 12 would have either maintained 
MV status 3 0 as DAZZLED or diagnosed a sensor fault and 
changed MV status 30 to BLIND. MV status 3 0 can only be 

3 0 DAZZLED for a limited "timeout" period. Thus, if RMV 3 6 
remained at unexpected levels, the timeout period would 
eventually expire, and transmitter 24 would change MV 
status 30 to BLIND. 

As shown in Fig. 3, transmitter 24 uses several 

3 5 sources of information, each of which is discussed below, 
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in generating VMV 26, W 28, MV status 30; device status 
32, diagnostic information 34, and alarm data 35. Raw 
data 44, the basic measurement information available to 
transmitter 24, is typically an electrical image of the 
5 output of one or more transducers 22 (e.g. , the frequency 
of oscillation or the resistance of a transducer 22) . 
Raw data 44 contains the maximum information available 
about the response of transducer 22 and is therefore a 
rich source of information for statistical tests to 
10 detect sensor faults. However, knowledge of expected 

process behavior cannot be applied readily to raw data 44 
and is more appropriately applied to statistics based on 
RMV 36. 

Because RMV 36 directly relates to a process 

15 parameter (e.g. , temperature or mass flow rate) , 

transmitter 24 can link the expected (no-fault) behavior 
of RMV 36 to the expected behavior of the process 
parameter associated with RMV 36. Transmitter 24 derives 
RMV 36 from raw data 44 by conventional processing. For 

20 example, if raw data 44 corresponds to the resistance of 
a transducer 22 and RMV 3 6 corresponds to temperature, 
transmitter 24 derives RMV 36 based on raw data 44 in 
light of known effects of temperature on the resistance 
of transducer 22. Often, transmitter 24 filters RMV 36 

25 to reduce the effect of sensor noise and high frequency 
process disturbances. When filtering occurs, RMV 36 
contains less information than raw data 44. 

To a certain extent, raw data 44 and RMV 36 are 
complementary sources of information. While raw data 44 

3 0 has more information content than RMV 36, RMV 36 is more 
easily compared with expected process behavior. Thus, 
raw data 44 and RMV 36 each offer useful information to 
transmitter 24. 

Auxiliary data 46 is provided by auxiliary signals 

3 5 within sensor 12. Auxiliary signals, though not directly 
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related to raw data 44 or RMV 36, give useful information 
about the health or performance of sensor 12 . For 
example, statistical tests to identify characteristic 
sensor or process behavior may be associated with 
5 particular auxiliary signals. Examples of auxiliary 
signals include the electrical properties of components 
within sensor 12 (e.g., signal levels at the input or 
output stages of power amplifiers) and hardware error 
information 50, Hardware error information 50 is a 

10 special, preprocessed form of auxiliary information 
generated by digital components within sensor 12, 
requiring little or no processing or interpretation. For 
example, a memory checksum error in a memory component of 
transmitter 24 would constitute hardware error 

15 information 50. 

In addition to information from within sensor 12 
or from process 14, transmitter 24 uses information from 
data control and management system 16 in generating 
output signals. Data control and management system 16 is 

20 known as the "Next Level Up" ("NLU") , and information 
from data control and management system 16 is known as 
NLU information 48. A difficulty associated with having 
transmitter 24 validate the output of sensor 12 is that 
transmitter 24 may have insufficient information to reach 

25 a valid conclusion. For example, transmitter 24 may be 
unable to distinguish between certain types of sensor 
faults (e.g., drift errors that cause the output of the 
sensor to change over time for a given input) and 
legitimate process changes. In these situations, 

30 transmitter 24 may refer to NLU information 48 for 

clarification. Data control and management system 16, 
which has access to additional information, including 
data from other sensors 12, provides transmitter 24 with 
the information needed to distinguish between process 

35 changes and sensor drift. 
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Transmitter 24 may request NLTJ information 48 such 
as anticipated process limits through standard requests 
to data control and management system 16. Alternatively , 
data control and management system 16 can provide 
5 unsolicited information, such as indications of changes 
in process behavior that will change the process 
parameters being measured by transducers 22, to 
transmitter 24. For example, if process 14 operates in a 
number of phases that each have distinct characteristics, 

10 data control and management system 16 can notify 

transmitter 24 when the phase of process 14 changes. 

Application knowledge base information 52 allows 
transmitter 24 to estimate a "wear and tear" effect on 
sensor performance. Application knowledge base 

15 information 52 describes the relationship between signals 
and sensor characteristics over time. In some 
applications, sensors are known to degrade much more 
rapidly under certain conditions (e.g. , at extremes of 
their operating range) . For example, if a normal range 

20 pH probe is exposed to more than about 12pH for as little 
as an hour, the probe may become alkali-conditioned and 
fail to respond when the solution becomes more acidic. 
Application knowledge base information 52 also includes 
factors such as the time elapsed since the last 

25 calibration or last maintenance of sensor 12. 

Sensor /process stimulus information 54 provides 
information about a known stimulus applied to the process 
or part of a sensor. Sensor/process stimulus information 
54 is used in implementing procedures for testing sensor 

30 12. A known stimulus is applied to process 14 or sensor 
12 and the response generated by sensor 12 is compared 
with an expected response. For example, sensor /process 
stimulus information 54 could describe a known force that 
has been introduced to a pressure transducer. 

35 Sensor/process stimulus information 54 is generated by 
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transmitter 24 (i.e., as part of a self-test initiated by 
transmitter 24) or sent by data control and management 
system 16 as NLU information 48. When testing disables 
the measuring capability of sensor 12, transmitter 24 
5 sets the MV status 30 of each disabled measurement to 
DAZZLED, bases VMV 26 and VU 28 on past performance, and 
sets device status 32 to TESTING. 

Fig. 3 also shows the functional units of 
transmitter 24. A diagnostic state machine 56 processes 

10 all of the information available to transmitter 24 and 
determines the diagnostic state 58 of sensor 12. 
Diagnostic state 58 is the central piece of information 
used by diagnostic state machine 56 in deriving VMV 26, 
VU 28, MV status 30, and device status 32. Because 

15 diagnostic state 58 may itself be helpful to users 

performing maintenance on sensor 12, it is the basis of 
diagnostic information 34, which is output upon a request 
by data control and management system 16. 

Referring also to Fig. 6, transmitter 24 performs 

20 the following operations during each sampling period. 
After getting raw data 44 from transducer 22 (step 72), 
diagnostic state machine 56 propagates raw data 44 
through a set of device equations 60 to generate RMV 36 
(step 74) . At the same time, transmitter 24 dynamically 

25 calculates RU 62 using an uncertainty analysis 64 based 
on device equations 60 and calibration data 66 in 
accordance with the established standards discussed above 
(step 74). In calculating RU 62, transmitter 24 assumes 
that no fault has occurred. RU 62 has a non-zero value 

30 under all operating conditions. Generally, RU 62 
increases under other than ideal conditions. 

Next, diagnostic state machine 5 6 obtains other 
information (step 76) and, based on the other 
information, raw data 44, RMV 36, and RU 62, calculates 

35 statistics or performs pattern matching to determine if 
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sensor 12 is operating correctly (step 78) . Based on the 
results of step 78 , diagnostic state machine 56 updates 
diagnostic state 58 (step 80) . 

Next, diagnostic state machine 56 modifies (68) 
5 RMV 36 based on diagnostic state 58 to produce VMV 26. 
Essentially,, diagnostic state machine 56 recalculates RMV 
36 after modifying the parameters used in the calculation 
to account for diagnostic state 58 and sets VMV 26 equal 
to the new RMV 36 (step 82). Thus, under normal 

10 operating conditions (when diagnostic state 58 does not 
require modification of any parameters) , VMV 26 typically 
equals RMV 36. 

At the same time, diagnostic state machine 56 
modifies (70) RU 62 based on diagnostic state 58 to 

15 produce VU 28. As with VMV 26, diagnostic state machine 
56 recalculates RU 62 after modifying the parameters used 
in the calculation to account for diagnostic state 58 and 
sets VU 28 equal to the new RU 62 f step 82) . Thus, VU 28 
typically equals RU 62 under normal operating conditions. 

20 Under other conditions, VU 28 typically exceeds RU 62. 

Next, diagnostic state machine 56 selects MV 
status 30 (step 84) and device status 32 (step 86) based 
on diagnostic state 58 and via either calculations or a 
lookup table. If necessary, diagnostic state machine 56 

25 sends alarm data 35 by updating alarm flags (step 88) . 
Also, if data control and management system 16 has 
requested it, diagnostic state machine 56 generates 
diagnostic information 34 based on diagnostic state 58 
(step 90) . 

30 Referring to Fig. 7, a self -validating temperature 

sensor 100 includes a thermocouple 102 and a transmitter 
104 that includes a processor 106. Typically, 
thermocouple 102 includes two dissimilar metals in 
contact and produces a voltage, V Diff , between two 

35 terminals 108 and 110. V Diff is proportional to the 
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difference between the temperature of a sensing junction 
112 and a reference junction 114. The sum of V Diff and 
v comp' a voltage proportional to the difference between 
the temperature of reference junction 114 and zero 
5 degrees, equals V Temp , a voltage proportional to the 
difference between the temperature of sensing junction 
112 and zero degrees. To determine V temp , V diff is 
amplified by amplifier 116 and V comp is generated by 
temperature sensor 118 and amplified by amplifier 120. 

10 The output 117 of amplifier 116 and the output 121 of 
amplifier 12 0 are then supplied to an analog-to-digital 
convertor ("ADC") 122 in processor 106. Processor 106 
uses amplifier outputs 117, 121, and other available 
information, to generate diagnostic state 58, RMV 36, and 

15 RU 62. Based on these signals, processor 106 generates 
VMV 26, VU 28, MV status 30, device status 32, alarm data 
35, and, when requested, diagnostic information 34. 

Referring to Fig. 8, self -validating temperature 
sensor 100 responds to a loss of power to amplifiers 116, 

2 0 12 0 as described below. During normal operation (time 0 
to 15) , VMV 26 equals RMV 36, which processor 106 
generates based on the sum of outputs 117, 121. 
Similarly, VU 28 equals RU 62, and indicates the 
uncertainty of VMV 26. MV status 3 0 is CLEAR. 

25 At time 15, the power supply 132 stops functioning 

and V Diff and V Comp (outputs 117, 121) both go to zero 
volts, which results in an RMV 36 of about negative 55 °C 
(for a particular transmitter design) . Processor 106 
detects the loss of power when power monitor 134, a 

30 digital auxiliary signal, switches from one to zero in 
response to the loss of power. Processor 106 then sets 
diagnostic state 58 to indicate that processor 106 has 
zero confidence in RMV 36. As a result, processor 106 
sets VMV 26 and VU 28 to a combination of the long and 

35 short term past values for VMV 2 6 and VU 28 respectively 
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as described above. Finally, processor 106 signals the 
severity and expected long term duration of the sensor 
fault by setting MV status 30 to BLIND. 

When the power supply is restored at time 36, 
5 processor 106 detects the change in power monitor 134 
from zero to one and sets MV status 30 to BLURRED. The 
"live" data from RMV 36 is merged with the previous value 
of VMV 26 as described above to give a new value for VMV 
26. Similarly, RU 62 is merged with the previous value 

10 of VU 28 to give a decreasing value for VU 28. At this 
time, processor 106 also initializes a recovery timer. 

Processor 106 generates VMV 26 and VU 28 by 
merging past values of VMV 26 and VU 28 with, 
respectively, RMV 36 and RU 62 until the recovery timer 

15 expires at time 56. (In this example, the recovery timer 
was set for 20 seconds.) At that time, processor 106 
sets MV status to CLEAR, sets VMV 26 equal to RMV 36, and 
sets VU 28 equal to RU 62. 

Referring now to Fig. 9, an open circuit fault 

20 occurs at time 13 when thermocouple 102 is disconnected 
from transmitter 104. In the presence of such a fault, 
RMV 36 is around 130°C, which corresponds to a normal 
value for output 121 but an abnormally high value for 
output 117 due to saturation of amplifier 116. (Pull-up 

25 resistor 136 causes saturation of amplifier 116 in the 
presence of an open circuit fault. ) In response to the 
abnormally high value of output 117, processor 106 sets 
diagnostic state 58 to indicate zero confidence in RMV 36 
and sets MV status 30 to DAZZLED. Processor 106 then 

30 generates VMV 26 and VU 28 based on a combination of the 
long and short term past values as described above. 

Next, referring again to Fig. 7, processor 106 
connects thermocouple 102 to voltage source 124 via 
switch 126 and monitors the voltage 130 produced across a 

35 resistor 128. Because of the open circuit, no current 
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flows in resistor 128 and voltage 130 is zero volts. 
From this, processor 106 confirms the open circuit fault 
and sets MV status 3 0 to BLIND. 

At time 27, the open circuit fault is corrected 
5 and output 117 returns to a normal value. Processor 106 
responds by setting diagnostic state 58 to indicate 
reduced confidence in RMV 36 (rather than no confidence), 
sets MV status 3 0 to BLURRED, and initializes a recovery 
timer. 

10 Thereafter, processor 106 generates VMV 26 and VU 

28 by merging past values of VMV 2 6 and VU 28 with, 
respectively, RMV 3 6 and RU 62 until the recovery timer 
expires at time 47 (where the recovery timer was set for 
20 seconds) . At that time, processor 106 sets MV status 

15 to CLEAR, sets VMV 26 equal to RMV 36, and sets VU 28 
equal to RU 62. 

Referring to Fig. 7, a loss of contact fault 
occurs when sensing junction 112 loses contact with the 
process element of which the temperature is being 

2 0 measured. Because a loss of contact fault does not 

produce an abnormal change in RMV 36, sensor 100 cannot 
readily detect the fault. 

As a result, sensor 100 uses current injection 
tests to detect loss of contact faults. In a current 

25 injection test, sensor 100 connects thermocouple 102 to 
voltage source 124 for a predetermined period and 
measures the effect on output 117. (The value of output 
117 before thermocouple 102 is connected to voltage 
source 124 is compared to the value after disconnection.) 

30 Referring to Fig. 10, a loss of contact fault 

occurs at time 12 and the measured temperature drops by 
about seven degrees. Because this is within normal 
operating parameters, sensor 100 does not immediately 
recognize the fault, and, instead, adjusts VMV 2 6 and 

3 5 maintains MV status 3 0 as CLEAR. 
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At time 28, processor 106 begins a current 
injection test. Because amplifier 116 does not read 
"live" data during the test, processor 106 sets MV status 
30 to DAZZLED and generates VMV 26 and VU 28 based on 
5 past performance as discussed above. At time 33 , 

processor 106 determines that the fault has occurred and 
sets MV status 30 to BLURRED . (Processor 106 assumes 
that, though contact has been lost, the temperature 
sensed by thermocouple 102 still approximates the actual 

1 0 temperature . ) 

At time 56, contact is reestablished. However, 
processor 106 interprets the sudden change in output 117 
as a spike and temporarily sets MV status 3 0 to DAZZLED. 
When output 117 remains at the increased value, processor 

15 106 sets MV status 30 back to BLURRED. (Processor 106 
does not set MV status 30 to CLEAR because processor 106 
has not detected the removal of the fault condition.) 

At time 66, processor 106 begins another current 
injection test and sets MV status 3 0 to DAZZLED. At time 

20 72, processor 106 determines that contact has been 

reestablished and, in response, sets MV status to BLURRED 
and initializes a recovery timer. At time 97, the 
recovery timer (which was set to 25 seconds) expires and 
processor 106 sets MV status to CLEAR. 

25 Referring to Fig. 11, another example of a self - 

validating sensor according to the invention is a 
Coriolis flow meter 150. Flow meter 150 measures three 
process parameters: mass flow rate, density, and 
temperature. Mass flow is measured directly using the 

30 principle of Coriolis acceleration, without needing to 
rely on external pressure, temperature, or specific 
gravity measurements. 

Structurally, flow meter 150 consists of a 
f lowtube 152 that is connected to a transmitter 154 by 

35 cables 156. Flowtube 152 includes a body 158 to which is 
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connected an input pipe 160 and an output pipe 162. Two 
parallel pipe loops 164 , 166 extend from body 158. Body 
158 contains passages which lead a process fluid from 
input pipe 160 to the beginning of loop 164, from the end 
5 of loop 164 to the beginning of loop 166 and from the end 
of loop 166 to output pipe 162 (the broken arrows in Fig. 
11 show the direction of flow in loops 164, 166). 

Transmitter 154 causes loops 164, 166 to pivotally 
oscillate about their axes of symmetry Y'-Z' and Y-Z by 

10 supplying anti-phase sinusoidal signals to 

electromagnetic drivers 168, 170. Transmitter 154 uses 
feedback to maintain the signals to drivers 168, 170 at 
the resonant frequency of loops 164, 166. Transmitter 
154 then detects movement of loops 164, 166 via sensors 

15 172, 174, which each produce a voltage that is 

proportional to the instantaneous velocity between loops 
164, 166. Transmitter 154 adjusts the amplitude of the 
signals to drivers 168, 170 to maintain the average 
amplitude of the voltages produces by sensors 172, 174 at 

2 0 a constant level. 

Transmitter 154 measures mass flow rate, density, 
and temperature in the following manner. First, 
transmitter 154 measures the mass flow rate of the 
process fluid by monitoring the effect of Coriolis forces 
25 on loops 164, 166. Coriolis forces acting on sections 
G'-H' and G-H of oscillating loops 164, 166 cause 
deflections of loops 164, 166. These deflections result 
in a phase angle difference between the voltages produced 
by sensors 172, 174 that is proportional to the mass flow 

3 0 rate. Next, transmitter 154 determines the density of 

the process fluid from the frequency of oscillation of 
loops 164, 166 (which equals the frequency of the signals 
supplied to drivers 168, 170). The density of the 
process fluid is inversely proportional to the square of 
3 5 the drive frequency. Finally, transmitter 154 measures 



WO 93/21505 



PCT/US93/03729 



- 26 - 

the temperature of the process fluid via a temperature 
sensor 176 located in body 158. Typically, temperature 
sensor 176 is an RTD device with a resistance that is 
temperature dependent. 
5 In the context of flow meter 150, the raw data 

available are the frequency 44c of a signal coming out of 
temperature sensor 176 (the frequency is proportional to 
the resistance of temperature sensor 176) , frequency 44b 
of the drive signals applied to drivers 168, 170, and the 

10 voltage outputs 44c of sensors 172, 174. From these 
signals , transmitter 154 derives three RMVs: the 
temperature of the process fluid 36a, the density of the 
process fluid 36b, and the mass flow rate 36c (derived 
from the phase angle between the sensor signals) . In 

15 addition r transmitter 154 performs uncertainty analyses 
to produces three RUs (62a, 62b, 62c) , each indicating 
the uncertainty of a corresponding RMV 36. 

After generating RMVs 36a-c and RUs 62a-c, 
transmitter 154 determines the diagnostic state 58 of 

20 flow meter 150. This determination is based on raw data 
44a-c, RMVs 36a-c, RUs 62a-c, and auxiliary data 46. 
Based on diagnostic state 58, transmitter 154 adjusts the 
parameters used in calculating RMVs 36a-c and RUs 62a-c 
and recalculates these values. Transmitter 154 then 

25 outputs the recalculated RMVs 36a-c and RUs 62a-c as VMVs 
26a-c and VUs 28a-c. Transmitter 154 also outputs a MV 
status 30a corresponding to temperature, a MV status 30b 
corresponding to density, and a MV status 3 0c 
corresponding to mass flow rate. Finally, transmitter 

3 0 154 outputs a single device status 32 corresponding to 
the status of flow meter 150. 

Referring again to Fig. 6, the procedure performed 
by transmitter 154 during each sample period can be 
implemented in software. An example of software for 

35 implementing of a self-validating Coriolis meter 150 is 
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included in microfiche appendix 1. In addition, an 
example of software for implementing a self-validating 
temperature sensor 100 as described above is included in 
microfiche appendix 2. The software in appendices 1 and 
5 2 may be implemented on any processor that supports a 
structured programming language. In an alternative 
approach, the procedure could be implemented using hard- 
wired circuitry. 

The pseudocode shown in Fig. 12 provides a 

10 simplified view of the procedure performed by transmitter 
154 during each sample period. Fig. 12 also shows, in 
parentheses, the steps performed in Fig. 6 that 
correspond to the steps in Fig. 12. Initially, 
transmitter 154 gets raw data 44a-c from flowtube 152 

15 (step 200) . Transmitter 154 then calculates RMVs 36a-c 
and RUs 62a-c (steps 202-206) . The pseudocode for 
calculating RMV 36a and RU 62a is shown in Fig. 13 and is 
discussed below. Next, transmitter 154 examines all 
available information (step 208) and determines 

2 0 diagnostic state 58, MV statuses 3 0a-c, and device status 

32 (step 210) . A portion of the pseudocode for 
determining diagnostic state 58 and MV statuses 3 0a-c is 
shown in Fig. 14 and discussed below. Based on 
diagnostic state 58, transmitter 154 corrects the 
25 parameters used in calculating RMV 36a-c and RU 62a-c 
(step 212) . Transmitter 154 then calculates VMVs 26a-c 
and VUs 28a-c (steps 214-218) using the procedure with 
which RMVs 3 6a-c and RUs 62a-c were calculated and 
corrected parameters . 

3 0 Referring to Fig. 13, transmitter 154 calculates 

RMV 36a and RU 62a as follows. First, transmitter 154 
calculates the resistance "R n of temperature sensor 176 
(step 250) . Transmitter 154 then calculates the 
uncertainty "d_R" of R based on an uncertainty analysis 
35 of the equation used to calculate R (step 252) . Next, 
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transmitter 154 calculates "temperature" (step 254) , and 
sets RMV 36a equal to temperature. Finally, transmitter 
154 calculates the uncertainty 11 d_temper atur e " of 
temperature (step 256) , and sets RU 62a equal to 
5 d_t emper atur e . Thus, as a first pass RMV 36a and RU 62a 
equal the measured temperature and its corresponding 
uncertainty. If transmitter 154 subsequently determines 
that it has less than nominal confidence in RMV 36a and 
RU 62a, transmitter 154 modifies any of the parameters, 

10 uncertainties, and/or raw data (e.g. , RK1, d_RKl, f_RTD) 
used in calculating temperature and d_temperature to 
reflect the impact of an expected fault. Transmitter 154 
then reper forms the procedure illustrated in Fig. 13 
using the modified information and sets VMV 26a and VU 

15 28a equal to the new values for temperature and 
d_temperature . Alternatively, if transmitter 154 
determines that the fault is too severe, transmitter 154 
may set VMV 26a and VU 28a based on historical data. 
Fig. 14 illustrates the procedure used by 

20 transmitter 154 to detect and respond to a loss of input 
from temperature sensor 176. Transmitter 154 maintains a 
variable, RTD_input_s t at e , that indicates the current 
status of the input from temperature sensor 176. As a 
first step, transmitter 154 checks RTD_input state (step 

25 300). 

If RTD_input_state equals RTD_INPUT_OK , which 
indicates that the input from temperature sensor 176 was 
functioning normally during the previous sample period, 
transmitter 154 checks the resistance of temperature 

3 0 sensor 176 (step 304) . If the resistance is less than 80 
ohms, this indicates that the connection between 
transmitter 154 and temperature sensor 176 has been lost. 
In response, transmitter 154 sets RTD_input_state to 
RTD_INPUT_JLOST (step 306) . Transmitter 154 then checks 

35 the value of RTD_spike_state, which indicates whether 
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transmitter 154 had sensed a spike in the output from 
temperature sensor 17 6 during the previous sample (step 
3 08) . If RTD_spike_state indicates that a spike had 
occurred, transmitter 154 resets RTD_input_state to 
5 indicate no spike (step 310) . (A spike is a less serious 
fault and is mooted by the loss of connection. ) 

If RTD_input_state equals RTD_INPUT_LOST , 
transmitter 154 checks the resistance of temperature 
sensor 176 (step 314). If the resistance is less than 

10 100 ohms (step 314) , this indicates that connection with 
temperature sensor 176 is still lost. (Different 
resistance values are used in steps 304 and 314 to avoid 
intermittent switching of RTD_input_state if, for 
example, the resistance fluctuates between 79 and 81 

15 ohms.) If connection is lost, transmitter 154 sets MV 
status 30a, which corresponds to temperature, to BLIND 
(step 316) and substitutes historical information (step 
318) about temperature for use in the recalculation steps 
(steps 214-18 of Fig. 12) . Because density and mass flow 

2 0 are based, in part, on temperature, transmitter 154 sets 

MV statuses 30b-c to BLURRED (steps 320-22). If the 
resistance is greater than 100 ohms, transmitter 154 sets 
RTD_input state to RTD_INPUT_RECOVER , to indicate that 
connection has been reestablished (step 32 6) . At this 
25 time, transmitter 154 initializes a recovery timer by 
setting RTD_input_count equal to zero (step 328). 

If RTD_input_state equals RTD_INPUT_RECOVER, 
transmitter 154 merges the past and present values for 
temperature as discussed above (step 3 32) . Transmitter 

3 0 154 then checks to see if the recovery timeout period has 

expired (step 334) . If it has, transmitter 154 sets 
RTD_input_state to RTD_INPUT_OK (step 3 3 6) . If it has 
not, transmitter 154 sets MV status 3 0a to BLURRED (step 
340) and increments RTD_input_count (step 342) . 
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Fig. 15 illustrates the response of flow meter 150 
to a loss of input from temperature sensor 176. At time 
9, the loss of input occurs and the unvalidated 
temperature measurement, RMV 36 a, begins to rapidly drop. 
5 At time 10, transmitter 154 sets diagnostic state 58 to 
indicate that a spike in the temperature input has 
occurred, and, in response, changes MV status 30a to 
DAZZLED, modifies VMV 26a and VU 28a based on past 
performance as discussed above, and leaves MV statuses 

10 30b-c, VMVs 26b-c, and VUs 28b-c unchanged (though, 
because density and mass flow rate are partially 
dependent on temperature, VMVs 26b-c and VUs 28b-c 
include the changes to VMV 26a and VU 28a) . 

At time 12 , the resistance of temperature sensor 

15 176 drops sufficiently low that transmitter 154 sets 
diagnostic state 58 to indicate that a loss of 
temperature input has occurred, and, in response, changes 
MV status 30a to BLIND, continues to base VMV 26a and VU 
28a on past performance, changes MV statuses 30b-c to 

20 BLURRED, and leaves VMVs 26b-c unchanged. Because the 
uncertainties of density and mass flow are based in part 
on the uncertainty of temperature, VUs 28b-c will 
increase to reflect the increase in VU 28a. 

At time 48, the resistance of temperature sensor 

25 176 increases to a sufficient level so that transmitter 
154 sets diagnostic state 58 to indicates that 
temperature input has been recovered, and, in response, 
changes MV status 30a to BLURRED , initializes a recovery 
timer, begins merging past and present values for VMV 26a 

30 and VU 28a, and changes MV statuses 3 Ob-c to CLEAR. 

At time 72, the recovery timer expires, and 
transmitter 154 sets diagnostic state 58 to indicate that 
the temperature input is fully recovered, and, in 
response, changes MV status 3 0a to CLEAR and bases VMV 

35 26a and VU 28a on RMV 3 6a and RU 62a. 
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Other embodiments are within the following claims. 
A portion of the disclosure of this patent 
document contains material which is subject to copyright 
protection. The copyright owner has no objection to the 
5 facsimile reproduction by anyone of the patent document 
or patent disclosure, as it appears in the Patent and 
Trademark Office file or records, but otherwise reserves 
all copyright rights whatsoever. 
What is claimed is: 



WO 93/21505 



PCT/US93/03729 



- 32 - 

Claims 

1. A sensor for providing a measurement and 
information about the validity of the measurement, said 
sensor comprising: 

5 a transducer for generating a data signal related 

to the value of a variable and 

a transmitter for receiving said data signal and 
generating in response thereto a first output signal 
indicating a measurement of said variable and a second 
10 output signal based on a dynamic uncertainty analysis of 
said first output signal • 

2. The sensor of claim 1, wherein, when said 
sensor experiences a fault, said transmitter modifies 
said first and second output signals to account for an 

15 impact of said fault. 

3. The sensor of claim 1, wherein said 
transmitter generates a third output signal that 
indicates a state of reliability of said first output 
signal . 

20 4. The sensor of claim 1, said sensor further 

comprising a plurality of transducers that generate a 
plurality of data signals related to the value of one or 
more variables, wherein said transmitter generates said 
first output signal based on one or more of said data 

25 signals. 

5. A sensor for providing measurements and 
information about the validity of the measurements, said 
sensor comprising: 

one or more transducers for generating a first 
30 data signal related to the value of a first variable and 
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a second data signal related to the value of a second 
variable , 

a transmitter for receiving said first and second 
data signals and generating in response thereto a first 
5 output signal related to a measurement of said first 
variable, a second output signal based on a dynamic 
uncertainty analysis of said first output signal, a third 
output signal related to a measurement of said second 
variable, and a fourth output signal based on a dynamic 
10 uncertainty analysis of said third output signal. 

6. The sensor of claim 5, wherein, when said 
sensor experiences a fault, said transmitter modifies 
said first, second, third, and fourth output signals to 
account for an impact of said fault. 

15 7. The sensor of claim 5, wherein said 

transmitter generates a fifth output signal that 
indicates a state of reliability of said first output 
signal. 

8. The sensor of claim 7, wherein said 
20 transmitter generates a sixth output signal that 

indicates a state of reliability of said third output 
signal . 

9. The sensor of claim 8, wherein said 
transmitter generates a seventh output signal that 

25 indicates an operational status of said sensor. 

10. The sensor of claim 5, wherein said sensor 
includes a plurality of transducers. 

11. The sensor of claim 5, wherein said sensor 
includes a single transducer. 
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12 . A method of providing a measurement and 
information about the validity of the measurement 
comprising the steps of: 

receiving a data signal related to the value of a 
5 variable; 

based on said data signal, estimating a 
measurement of said variable; 

generating a first output signal related to the 
estimated measurement of said variable; 
10 performing an uncertainty analysis of said first 

output signal; and 

generating a second output signal based on said 
uncertainty analysis .. 

13. The method of claim 12, said method further 
15 including the step of determining whether said data 

signal is faulty, wherein, when said data signal is 
faulty, said estimating step modifies said estimated 
measurement to account for an impact of said fault. 

14. The method of claim 13, wherein, when said 
20 data signal is faulty, said uncertainty analysis accounts 

for an impact of said fault. 

15. The method of claim 12, said method further 
including the step of generating a third output signal 
that indicates a state of reliability of said first 

25 output signal. 

16. The method of claim 12, said method further 
including the step of receiving a plurality of data 
signals, wherein said estimating step estimates the 
measurement of said variable based on said plurality of 

30 data signals. 
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17. A method of providing measurements and 
information about the validity of the measurements 
comprising the steps of: 

receiving a first data signal related to the value 
5 of a first variable; 

receiving a second data signal related to the 
value of a second variable; 

based on said first data signal, estimating a 
measurement of said first variable; 
10 generating a first output signal related to the 

estimated measurement of said first variable; 

performing an uncertainty analysis of said first 
output signal; 

generating a second output signal based on said 
15 uncertainty analysis of said first output signal; 

based on said second data signal, estimating a 
measurement of said second variable; 

generating a third output signal related to the 
estimated measurement of said second variable; 
20 performing an uncertainty analysis of said third 

output signal; and 

generating a fourth output signal based on said 
uncertainty analysis of said third output signal. 

18. The method of claim 17, said method further 
25 including the step of determining whether said first data 
signal is faulty, wherein, when said first data signal is 
faulty, said estimating step modifies said estimated 
measurement of said first variable to account for an 
impact of said fault. 

30 19 • The method of claim 18, wherein, when said 

first data signal is faulty, said uncertainty analysis of 
said first output signal accounts for an impact of said 
fault. 
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20. The method of claim 17, said method further 
including the step of determining whether said second 
data signal is faulty, wherein, when said second data 
signal is faulty, said estimating step modifies said 

5 estimated measurement of said second variable to account 
for an impact of said fault. 

21. The method of claim 20, wherein, when said 
second data signal is faulty, said uncertainty analysis 
of said third output signal accounts for an impact of 

10 said fault. 

22. The method of claim 17, said method further 
including the step of generating a fifth output signal 
that indicates a state of reliability of said first 
output signal. 

15 23. The method of claim 22, said method further 

including the step of generating a sixth output signal 
that indicates a state of reliability of said third 
output signal. 

24. A temperature sensor for providing a 
20 temperature measurement and information about the 

validity of the temperature measurement, said temperature 
sensor comprising: 

a transducer for generating a data signal related 
to a temperature and 
25 a transmitter for receiving said data signal and 

generating in response thereto said temperature 
measurement and an uncertainty signal based on a dynamic 
uncertainty analysis of said temperature measurement. 



30 



25. The sensor of claim 24 wherein, when said 
temperature sensor experiences a fault, said transmitter 
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modifies said temperature measurement and said 
uncertainty signal to account for an impact of said 
fault. 



26. The sensor of claim 24, wherein said 
5 transmitter generates a third output signal that 

indicates a state of reliability of said temperature 
measurement . 



27. A Coriolis flow meter for providing 
measurements of mass flow, density, and temperature and 

10 information about the validity of the measurements, said 
Coriolis flow meter comprising: 

one or more transducers for generating a first 
data signal related to mass flow, a second data signal 
related to density, and a third data signal related to 

15 temperature , 

a transmitter for receiving said first, second, 
and third data signals and generating in response thereto 
a mass flow measurement signal, a first uncertainty 
signal based on a dynamic uncertainty analysis of said 

2 0 mass flow measurement signal, a density measurement 

signal, a second uncertainty signal based on a dynamic 
uncertainty analysis of said density measurement signal, 
a temperature measurement signal, and a third uncertainty 
signal based on a dynamic uncertainty analysis of said 

25 temperature measurement signal. 



28. The Coriolis flow meter of claim 27, wherein, 
when said Coriolis flow meter experiences a fault, said 
transmitter modifies said measurement signals and said 
uncertainty signals to account for an impact of said 
30 fault. 
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29. The Coriolis flow meter of claim 27, wherein 
said transmitter generates a first reliability signal 
that indicates a state of reliability of said mass flow 
measurement signal, a second reliability signal that 

5 indicates a state of reliability of said density 

measurement signal, and a third reliability signal that 
indicates a state of reliability of said temperature 
measurement signal. 

30. The Coriolis flow meter of claim 29, wherein 
10 said transmitter generates a operational status signal 

that indicates an operational status of said Coriolis 
flow meter. 
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Step Action 

250 R = (RK1 * tran_temp + RK2) * f_RTD + 
RK3 * tran_temp + RK4 

[RK1-4 are calibration constants, tran_temp is 
the temperature of transmitter 154, and f_RTD 
is the frequency of the signal coming out of 
RTD temperature sensor 176.] 

252 d_R = sqrt ( 

sqr (tran_temp * f_RTD * d_RK1) + 
sqr (f_RTD * d_RK2) + 

sqr (tran_temp * d_RK3) + 

sqr (d_RK4) + 

sqr ((RK1 * f_RTD + RK3) * 

d_tran_temp) + 
sqr ((RK1 * tran_temp + RK2) * 
d_f_RTD)) 

[d_x is the uncertainty of x.] 

254 temperature = RTD_A * R * R + RTD_B * R + RTD_C 

256 d_temperature = (2.0 * RTD_A * R + RTD_B) * d_R 
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